fix(delete): apply must rebuild the retirement evidence the approver signed

[rldyourmnd]

gds repository delete --apply could not succeed for any repository.

The precondition observer is constructed twice — once when the plan is stored, once when it is applied — and the two sites had drifted. The apply site set neither retirement nor preserve. Without the retirement reader every remote collection stays unread, and gatherRetirementEvidence classifies unread as unknown, which blocks by design. Without the preserved set every identity the operator explicitly accepted losing reads as blocking again. Retirable was therefore false on every apply, the observation returned an error, and the engine reported it as GDS_STALE_PLAN — "observed repository state no longer matches the plan" — with an empty mismatch list in the journal. The state had not changed; the observation had failed. Nothing in the tree tested this path.

Passing --preserve again at apply could not have fixed it either: the declaration belongs to the plan the approver signed, and it was not stored anywhere.

• ProviderTransition.PreservedIdentities now carries the accepted losses, so they live in the plan parameters and inside the plan digest the approval binds. StepTransition rejects a non-string entry rather than silently dropping it.
• newRepositoryDeleteObserver becomes the single construction site for both paths, so they cannot drift again. Both preserve and retirement derive from the stored transition.
• --preserve joins --inventory-root and --confirm-* as a planning input refused on apply, which is what it always was in substance.

Tests: the parameter round trip now covers the preserved set and its rejection of a non-string entry, and a new core/app test asserts the shared observer carries the approved declaration and analysis root.

Because the Go sources are part of this repository's own compiled policy inputs, .gds/bundle.lock.yaml and .github/workflows/gds-ci.yml are regenerated through gds generate repository --plan/--apply with a binary built from this branch; without that, GDS_CONTEXT_POLICY_SOURCE_DIGEST_MISMATCH fails core/assurance, core/cli and core/context.

Verification: scripts/validate_go_core.sh --quick exits 0 — 66 packages ok, no failures.

https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX